To: 


Of: 


İCO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Solarwave Limited 


19 Lodge Lane, The Rear, Grays, RM17 5RY 


The Information Commissioner (“the Commissioner”) has decided to 

issue Solarwave Limited (“Solarwave”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is in 
relation to a serious contravention of regulation 21 of the Privacy and 


Electronic Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner's intended decision. 


Legal framework 


Solarwave, whose registered office is given above (Companies House 
Registration Number: 11327931) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 


contrary to regulation 21 of PECR. 


Regulation 21 applies to the making of unsolicited calls for direct 
marketing purposes. It means that if a company wants to make calls 


promoting a product or service to an individual who has a telephone 
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number which is registered with the Telephone Preference Service Ltd 


(“TPS”), then that individual must have given their consent to that 


company to receive such calls. 
5; Regulation 21 paragraph (1) of PECR provides that: 


“(1) A person shall neither use, nor instigate the use of, a public 
electronic communications service for the purposes of making 


unsolicited calls for direct marketing purposes where- 


(a) the called line is that of a subscriber who has previously 
notified the caller that such calls should not for the time being 


be made on that line; or 


(b) the number allocated to a subscriber in respect of the called 


line is one listed in the register kept under regulation 26.” 
6. Regulation 21 paragraphs (2), (3), (4) and (5) provide that: 


“(2) A subscriber shall not permit his line to be used in contravention 


of paragraph (1). 


(3) A person shall not be held to have contravened paragraph (1)(b) 
where the number allocated to the called line has been listed on the 
register for less than 28 days preceding that on which the call is 


made. 


(4) Where a subscriber who has caused a number allocated to a line of 
his to be listed in the register kept under regulation 26 has notified 
a caller that he does not, for the time being, object to such calls 


being made on that line by that caller, such calls may be made by 
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that caller on that line, notwithstanding that the number allocated 


to that line is listed in the said register. 


(5) Where a subscriber has given a caller notification pursuant to 


paragraph (4) in relation to a line of his— 


(a) the subscriber shall be free to withdraw that notification at 
any time, and 
(b) where such notification is withdrawn, the caller shall not 


make such calls on that line.” 


Under regulation 26 of PECR, the Commissioner is required to maintain 
a register of numbers allocated to subscribers who have notified them 
that they do not wish, for the time being, to receive unsolicited calls for 
direct marketing purposes on those lines. The Telephone Preference 
Service Limited (“TPS”) is a limited company which operates the 
register on the Commissioner’s behalf. Businesses who wish to carry 
out direct marketing by telephone can subscribe to the TPS for a fee 


and receive from them monthly a list of numbers on that register. 


Section 122(5) of the Data Protection Act 2018 (“DPA18”") defines 
direct marketing as “the communication (by whatever means) of any 
advertising material which is directed to particular individuals”. This 
definition also applies for the purposes of PECR (see regulation 2(2) 
PECR and Schedule 19 paragraphs 430 & 432(6) DPA18). 


Consent in PECR is now defined, from 29 March 2019, by reference to 
the concept of consent in Regulation 2016/679 (“the GDPR”): 
regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. Article 
4(11) of the GDPR sets out the following definition: “'consent’ of the 
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data subject means any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 


she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 

Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 

PECR, as variously amended states the Commissioner may serve a 

person with a monetary penalty notice if the Commissioner is satisfied 

that - 

“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003 by the person, and 

(b) subsection (2) or (3) applies. 

(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 
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The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implements Directive 2002/58/EC, and Directive 2009/136/EC 
which amended the earlier Directive. Both the Directive and PECR are 
“designed to protect the privacy of electronic communications users": 
Leave.EU & Eldon Insurance Services v Information Commissioner 
[2021] UKUT 26 (AAC) at paragraph 26. The Commissioner seeks to 
interpret and apply PECR in a manner consistent with the purpose of 
the Directive and PECR of ensuring a high level of protection of the 
privacy of individuals, and in particular the protections provided from 
receiving unsolicited direct marketing communications which the 


individual has not consented to receive. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


Solarwave first came to the attention of the Commissioner in 
September 2020 when complaints about unsolicited marketing calls 
from two specific calling line identifiers (“CLI’s”) were identified from 
the monthly reports received from the Telephone Preference Service 
(“TPS”). 
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The Commissioner made enquiries with the relevant Communications 
Service Provider (“CSP”) which confirmed that the CLI’s in question, 
and a number of others, had been allocated to Solarwave. They 
provided detailed call records for the period between 2 January 2020 
and 2 October 2020 which showed that, over that time period, 
Solarwave had made 144,937 calls, of which, 73,217 were made to 
individual subscribers whose number had been registered with the TPS 
for not less than 28 days. The Commissioner was able to establish that 
since January 2020 there had been a number of complaints made 
regarding calls from CLI’s attributed to Solarwave via both the 
Commissioner's online reporting tool, and the Telephone Preference 
Service ("TPS"). 


The following are examples of the complaints received by the ICO and 
TPS: 


“They said it was a follow up call to talk about solar panels, but we 
already have solar panels so there's no way my husband and I would 
have asked them to call us back to talk about solar panels. I said that I 
didn't want to talk to them, and they then called me an idiot and hung 
up. The caller was rude - calling me an idiot because I didn't want to 
take his call.” 


“My mother who is aged 90 has solar panels. She has been called a 
number of times by Solarwave suggesting that they could inspect her 
panels as they may be faulty. This is causing her distress and they do 
not consent the storage of her Personal Data - she has never dealt with 


them and they were not the installers of her system” 


“Solar panel maintenance. Asked them to stop calling before. Tried 


ignoring the frequent calls by not answering. Still ringing so picked up 
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yesterday and told them again and that we are registered with you. 
Even more annoying now as we are now ex-directory. These companies 


are the bane of a lot of people's lives and need to be stopped. As if life 


isn't difficult enough at the moment!” 


“Asking about servicing my solar PV system. They said that they had 
obtained my number from a database of installed PV systems. I told 


them I was TPS registered and they terminated the call.” 


The Commissioner sent an initial investigation letter to Solarwave on 
12 October 2020, setting out her concerns with Solarwave’s PECR 
compliance and asking for details of call volumes and evidence of 


consent, amongst other information. 


A response to this initial investigation letter was provided on 13 
October 2020, supplying a copy of their call script and a brief 
explanation of their processes. In terms of its methods for obtaining 
data, Solarwave advised that it used data purchased from third party 
lead generation suppliers ("third-party data providers"); and via direct 
lead generation through ja campaigns. Solarwave explained 
that it was unable to provide evidence of consent for the calls because 
“at that time, we had no measure in places to ensure that persons 
being contacted were not registered with the Telephone Preference 
Service, other than requesting from our data suppliers”. It explained 
that as of 18 September 2020 it had changed its processes and now 
screened all purchased data from an alternative provider to ensure 


compliance. It also confirmed that it holds an internal suppression list. 


On 14 October 2020 the Commissioner sought further information from 


Solarwave in respect of the third-party data providers from whom data 
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was obtained including copy contracts and any due diligence carried 
out in relation to consent. It was also asked about the apparent lack of 


TPS screening, the new procedures implemented and staff training. 


Solarwave responded on 15 October 2020. 


In its response it confirmed that calls made since January 2020 had not 
been screened against the TPS, as it was their understanding that the 
data had already been screened prior to purchasing. An invoice was 
provided from one of its third-party data providers but copy contracts 
were neglected to be provided as requested. They also did not provide 
any written policies in response to their updated procedures with their 
alternative data provider. Instead, they provided a picture of a 
database showing numbers, names and addresses stating that “we put 
our data into a CVS file that can then be uploaded into the system and 


screened.” 


The missing information was requested by the Commissioner on 16 
October 2020 and a response from Solarwave was received on the 
same day. However, again the document provided was not a contract 
with its third-party data provider but a further invoice from the 


provider dated 19 December 2019 for various records. 


Following an end of investigation letter sent by the Commissioner on 
12 November 2020, Solarwave responded to reiterate that it had no 
intention of giving excuses regarding the infringement, just that it was 
under the impression the purchased data was screened against the 
TPS. However, it highlighted that it has since employed a third party 
who will screen the data every 28 days as suggested by the TPS. 


The Commissioner is satisfied that the 73,217 calls were all made for 


the purposes of direct marketing as defined by section 122(5) DPA18. 
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The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21 of PECR by Solarwave and, if so, 


whether the conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that Solarwave contravened regulation 21 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


Between 2 January 2020 and 2 October 2020, Solarwave used a public 
telecommunications service for the purposes of making 73,217 
unsolicited calls for direct marketing purposes to subscribers where the 
number allocated to the subscriber in respect of the called line was a 
number listed on the register of numbers kept by the Commissioner in 
accordance with regulation 26, contrary to regulation 21(1)(b) of PECR. 
This resulted in 30 complaints being made to the TPS and the 


Commissioner. 


The Commissioner is also satisfied for the purposes of regulation 21 
that these 73,217 unsolicited direct marketing calls were made to 
subscribers who had registered with the TPS at least 28 days prior to 
receiving the calls, and they had not given their prior consent to 


Solarwave to receive calls. 
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The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because there have been multiple breaches 
of regulation 21 by Solarwave arising from the organisation’s activities 
over a nine month period, and this led to a substantial number 
(73,217) of unsolicited direct marketing calls being made to 
subscribers who were registered with the TPS, and a number of 
complaints being made as a result. Furthermore, Solarwave has been 
unable to demonstrate it held valid consent for the purpose of these 


calls. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. In the Commissioner’s view, this means that 
Solarwave’s actions which constituted that contravention were 
deliberate actions (even if Solarwave did not actually intend thereby to 


contravene PECR). 


The Commissioner does not consider that Solarwave deliberately set 


out to contravene PECR in this instance. 
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The Commissioner has gone on to consider whether the contravention 


identified above was negligent. This consideration comprises two 


elements: 


Firstly, she has considered whether Solarwave knew or ought 
reasonably to have known that there was a risk that this contravention 


would occur. She is satisfied that this condition is met. 


The Commissioner has published detailed guidance for companies 
carrying out marketing explaining their legal requirements under PECR. 
This guidance explains the circumstances under which organisations 
are able to carry out marketing over the phone, by text, by email, by 
post or by fax. Specifically, it states that live calls must not be made to 
subscribers who have told an organisation that they do not want to 
receive calls; or to any number registered with the TPS, unless the 
subscriber has specifically consented to receive calls. The 
Commissioner has also published detailed guidance on consent under 
the GDPR. In case organisations remain unclear on their obligations, 
the ICO operates a telephone helpline. ICO communications above 
previous enforcement action where businesses have not complied with 


PECR are also readily available. 


Standard practice of the TPS is to contact the organisation making the 
calls on each occasion a complaint is made. It is therefore reasonable 
to believe that Solarwave would have received a notification from the 
TPS for each of the complaints being made in this case. That there 
were 24 complaints made to the TPS alone over the period of the 
contravention should have made Solarwave aware of the risk that such 


contraventions may occur, and were indeed occurring. 
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It is therefore reasonable to suppose that Solarwave should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether 
Solarwave failed to take reasonable steps to prevent the contravention. 


Again, she is satisfied that this condition is met. 


The Commissioner’s direct marketing guidance makes clear that 
organisations acquiring marketing lists from a third party must 
undertake rigorous checks to satisfy themselves that the personal data 
was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary consent. It is not 
acceptable to rely on assurances given by third party providers 


without undertaking proper due diligence. 


Solarwave failed to carry adequate due diligence checks on its third- 
party data providers and was unable to show that it had adequate 

contracts in place. They neglected to ensure that the data purchased 
had been screened against the TPS every 28 days as required. These 
are basic requirements for any organisations conducting a live direct 


marketing campaign. 


Reasonable steps in these circumstances may also have included 
asking its third-party data providers for evidence that the subscribers 
had specifically consented to receiving calls from Solarwave; screening 
the data it intended to rely on against the TPS register itself 
(regardless of any assurances that might have been given to it by the 
third-party data providers); and ensuring an effective suppression 


system was in place for individuals who did not wish to be contacted. 
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Given the volume of calls and complaints, it is clear that Solarwave 


failed to take those reasonable steps. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has taken into account the following aggravating 


features of this case: 


The complaints received by both the Commissioner and the TPS suggest 
that Solarwave was seen to be rude and persistent when making calls, 


ignoring stop requests. 


The actions of Solarwave were carried out to generate business and to 
increase profits, gaining an unfair advantage on those businesses 


complying with the PECR; 


The Commissioner produces clear guidance via its website on the rules 
of direct marketing. She also operates a helpline should organisations 
be unsure and require further clarification. The Commissioner has 
previously taken openly publicised regulatory action against other 
organisations within the same sector and it is therefore reasonable to 
expect informed awareness of PECR within the industry in which 


Solarwave operate; 


Solarwave continued to make unsolicited calls to subscribers pending the 
outcome of the Commissioner's investigation and complaints continue to 
be received. Solarwave’s website states that it is an accredited member 
of two trader organisations. Enquiries undertaken by the Commissioner 


in December 2020 showed no traces of their membership. Indeed, one 
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of the two trade bodies advised the Commissioner that the Company had 
been expelled on 21 October 2020. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account representations made 
by Solarwave on this matter dated 26 March 2021. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has attempted to consider the likely impact of a 
monetary penalty on Solarwave. As part of its representations 
Solarwave provided the Commissioner with some financial information 
in response to the Notice of Intent. However, following a review of the 
information received, further financial information was requested to 
clarify its position on 24 April 2021. No response to this request was 
received. She has decided on the information that is available to her, 
that a penalty remains the appropriate course of action in the 


circumstances of this case. 


The Commissioner's underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls is a matter of significant public 
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concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. This is an opportunity 


to reinforce the need for businesses to ensure that they are only 


telephoning consumers who want to receive these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £100,000 (One hundred thousand 
pounds) is reasonable and proportionate given the particular facts of 


the case and the underlying objective in imposing the penalty. 
Conclusion, 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 7 July 2021 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
6 July 2021 the Commissioner will reduce the monetary penalty by 
20% to £80,000 (Eighty thousand pounds). However, you should 
be aware that the early payment discount is not available if you decide 


to exercise your right of appeal. 
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There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 4t" day of June 2021. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


Le Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2% If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0300 123 4504 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5, Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 


20 


